CVE-2023-46729: Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint
First published: Thu Nov 09 2023(Updated: )
### Impact An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This could open door for other attack vectors: * client-side vulnerabilities: XSS/CSRF in the context of the trusted domain; * interaction with internal network; * read cloud metadata endpoints (AWS, Azure, Google Cloud, etc.); * local/remote port scan. This issue only affects users who have [Next.js SDK tunneling feature](https://docs.sentry.io/platforms/javascript/guides/nextjs/manual-setup/#configure-tunneling-to-avoid-ad-blockers) enabled. ### Patches The problem has been fixed in [sentry/nextjs@7.77.0](https://www.npmjs.com/package/@sentry/nextjs/v/7.77.0) ### Workarounds Disable tunneling by removing the `tunnelRoute` option from Sentry Next.js SDK config — `next.config.js` or `next.config.mjs`. ### References * [Sentry Next.js tunneling feature](https://docs.sentry.io/platforms/javascript/guides/nextjs/manual-setup/#configure-tunneling-to-avoid-ad-blockers) * [The fix](https://github.com/getsentry/sentry-javascript/pull/9415) * [More Information](https://blog.sentry.io/next-js-sdk-security-advisory-cve-2023-46729/) ### Credits * [Praveen Kumar](https://hackerone.com/mr_x_strange)
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/@sentry/nextjs | >=7.26.0<7.77.0 | 7.77.0 |
| Sentry Sentry Software Development Kit | >=7.26.0<7.77.0 | |
| >=7.26.0<7.77.0 |
Remedy
https://github.com/getsentry/sentry-javascript/commit/ddbda3c02c35aba8c5235e0cf07fc5bf656f81be
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/getsentry/sentry-javascript/commit/ddbda3c02c35aba8c5235e0cf07fc5bf656f81be
- https://github.com/getsentry/sentry-javascript/pull/9415
- https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-2rmr-xw8m-22q9
- https://blog.sentry.io/next-js-sdk-security-advisory-cve-2023-46729/
- https://docs.sentry.io/platforms/javascript/guides/nextjs/manual-setup/#configure-tunneling-to-avoid-ad-blockers
- https://www.npmjs.com/package/@sentry/nextjs/v/7.77.0
- https://nvd.nist.gov/vuln/detail/CVE-2023-46729
- https://github.com/advisories/GHSA-2rmr-xw8m-22q9 (Advisory)
Frequently Asked Questions
What is the impact of CVE-2023-46729?
The vulnerability allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user, which can lead to client-side vulnerabilities like XSS/CSRF.
Which software is affected by CVE-2023-46729?
The vulnerability affects the @sentry/nextjs package with versions between 7.26.0 and 7.77.0.
What is the severity of CVE-2023-46729?
CVE-2023-46729 has a severity rating of 9.3 (Critical).
How can I fix CVE-2023-46729?
To fix CVE-2023-46729, update the @sentry/nextjs package to version 7.77.0 or later.
Where can I find more information about CVE-2023-46729?
Additional information about CVE-2023-46729 can be found in the GitHub advisory and pull request linked in the references section.
- collector/github-advisory-latest
- alias/GHSA-2rmr-xw8m-22q9
- alias/CVE-2023-46729
- collector/nvd-cve
- collector/github-advisory
- agent/author
- agent/type
- agent/remedy
- agent/weakness
- agent/severity
- agent/title
- agent/references
- agent/description
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- agent/tags
- agent/trending
- package-manager/npm
- vendor/sentry
- canonical/sentry sentry software development kit
- version/sentry sentry software development kit/7.26.0